What happened
DoraFactory lost 7,872 DORA when the ChainSwap cross-chain bridge was exploited on 11 July 2021. ChainSwap was the bridge DoraFactory used for cross-chain DORA liquidity. The attacker took the tokens from the bridge contract and sold them straight away on Uniswap. DoraFactory said the loss was worth less than $50,000; the figure shown here is $42,373. Most of the tokens belonged to the DoraFactory foundation and had been placed on the bridge to provide cross-chain liquidity.
DoraFactory's own contracts were not the target. ChainSwap said a logic flaw in its bridge quota code let non-whitelisted addresses raise withdrawal quotas; about 20 assets worth roughly $4 million were taken across projects. ChainSwap promised to cover DoraFactory's loss, took the bridge offline and froze mapping tokens. DoraFactory pulled all of its cross-chain DeFi liquidity until it had a secure alternative.
How it happened
- ChainSwap's bridge let signer nodes raise a token's cross-chain quota automatically, so a valid claim needed signatures from addresses that had quota.
- Because of a logic flaw, addresses that were not whitelisted signers could also raise the quota. Rekt reports that the attacker called the bridge's
receivefunction, supplying a fresh address as the signature in each call and paying only a small fee. - The bridge accepted these claims and released tokens it held, 7,872 DORA among them.
- The attacker sold the DORA on Uniswap right away.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
